kb01/zmk
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(hid): Correct off-by-one buffer overflow with NKRO

Browse source
This commit is contained in:
Keeley Hoek 2024-04-07 07:05:51 -04:00 • committed by Pete Johanson
parent a9021deef6
commit e22bc7620c
2 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
app/include/zmk/hid.h
View file

@ -6,6 +6,8 @@
#pragma once
#include <zephyr/sys/util.h>
#include <zephyr/usb/usb_device.h>
#include <zephyr/usb/class/usb_hid.h>
@ -200,7 +202,7 @@ struct zmk_hid_keyboard_report_body {
zmk_mod_flags_t modifiers;
uint8_t _reserved;
#if IS_ENABLED(CONFIG_ZMK_HID_REPORT_TYPE_NKRO)
uint8_t keys[(ZMK_HID_KEYBOARD_NKRO_MAX_USAGE + 1) / 8];
uint8_t keys[DIV_ROUND_UP(ZMK_HID_KEYBOARD_NKRO_MAX_USAGE + 1, 8)];
#elif IS_ENABLED(CONFIG_ZMK_HID_REPORT_TYPE_HKRO)
uint8_t keys[CONFIG_ZMK_HID_KEYBOARD_REPORT_SIZE];
#endif

2
app/src/hid.c
View file

@ -126,7 +126,7 @@ zmk_hid_boot_report_t *zmk_hid_get_boot_report(void) {
memset(&boot_report.keys, 0, HID_BOOT_KEY_LEN);
int ix = 0;
uint8_t base_code = 0;
for (int i = 0; i < (ZMK_HID_KEYBOARD_NKRO_MAX_USAGE + 1) / 8; ++i) {
for (int i = 0; i < sizeof(keyboard_report.body.keys); ++i) {
if (ix == keys_held) {
break;
}